Update dependencies and fix audit findings

Backend:
- cargo update: rustls 0.23.40 -> 0.23.45 (RUSTSEC-2026-0285), plus
  semver-compatible bumps (actix-web 4.15, tokio 1.53, diesel 2.3.13, ...)
- Disable actix-web's `http2` feature: the server binds plain HTTP/1.1,
  and the feature pulls in the unmaintained h2 0.3 line (RUSTSEC-2026-0258)

Frontend:
- Update all packages within their ranges, fixing 8 npm audit findings
  (nanoid, postcss, undici, ...)
- vitest 4 -> 5
- Remove unused unreadCount in RssFeeds.vue (lint error)

Cargo.toml

@@ -10,7 +10,12 @@ anyhow = "1"
 reqwest = { version = "0.13", features = ["json", "blocking"] }
 tokio = { version = "1", features = ["full"] }
 rss = { version = "2.0.13" }
-actix-web = "4.13"
+# `http2` is left out: the server binds plain HTTP/1.1 (no TLS/h2c), and the
+# feature pulls in the unmaintained h2 0.3 line (RUSTSEC-2026-0258).
+actix-web = { version = "4.15", default-features = false, features = [
+    "macros", "compress-brotli", "compress-gzip", "compress-zstd",
+    "cookies", "unicode", "compat", "ws",
+] }
 actix-rt = "2.10"
 futures = "0.3.31"
 serde = { version = "1.0.228", features = ["alloc", "derive", "serde_derive"] }

vue/package.json

@@ -26,6 +26,6 @@
     "jsdom": "^29.1.1",
     "prettier": "^3.8.3",
     "vite": "^8.0.16",
-    "vitest": "^4.1.8"
+    "vitest": "^5.0.2"
   }
 }

vue/src/components/RssFeeds.vue

@@ -1,5 +1,5 @@
 <script setup>
-import { onMounted, onBeforeUnmount, computed, nextTick, watch } from 'vue';
+import { onMounted, onBeforeUnmount, nextTick, watch } from 'vue';
 import { useFeeds } from '@/composables/useFeeds';
 
 const {
@@ -20,8 +20,6 @@ const {
   markCurrentArticleRead,
 } = useFeeds()
 
-const unreadCount = computed(() => feeds.value.filter(f => !f.read).length)
-
 const shareLabel = navigator.share ? 'Share' : 'Copy link'
 
 function scrollToNextArticle() {